Last Updated: October 30, 2023
Authorization to Use and Disclose Protected Health Information
The privacy of your health information is important to us. Short Messaging Service (“SMS“) is not always secure. We call your health information that identifies you, your protected health information (“PHI“). To protect your PHI, we will follow federal and state privacy laws, including the Health Insurance Portability and Accountability Act and regulations (“HIPAA“). We refer to all of these laws as the “Privacy Rules.” Here we let you know how we will use and disclose your PHI.
PHI That Will Be Used/Disclosed:
The PHI that will be transmitted includes:
1. Medical information about you including your medical history and present/past care plans.
2. Your responses to text messages received from the Spruce Health service.
Purposes For Which Your PHI Will Be Used/Disclosed:
We will use and share your PHI only with your care providers and any other individuals you consent to release your information to. We will use and share your PHI to provide you with care management content specific to your treatment plan and medications. We will also use and share your PHI to conduct normal business operations. We may share your de-anonymized data with other people and places that help us conduct this initiative, such as laboratories, data management centers, data monitors, contract research organizations, Institutional Review Boards (IRBs), and other institutions. If you leave the Spruce Health platform, we may use your non-personally identifiable information for software improvement and any other business-related operations.
Use And Disclosure Of Your Information That Is Required by Law:
We will use and disclose your PHI when we are required to do so by law. This includes laws that require us to report child abuse or abuse of elderly or disabled adults. We will also comply with legal requests or orders that require us to disclose your PHI. These include subpoenas or court orders.
Authorization To Use PHI Is Required To Participate:
By consenting to this authorization, you give us permission to use and share your PHI as described in this document. You do not have to sign this form to authorize the use and disclosure of your PHI. If you do not sign this form, then you may not receive text messages from the Spruce Health platform.
People Who will Use/Disclose Your PHI:
The following people and groups will use and disclose your PHI:
A) Spruce Health may use your non-personally identifiable information for internal software quality improvement purposes.
B) The following people and groups will use your PHI to make sure the research is done correctly and safely: government regulation agencies including the Office for Human Research Protections and Office for Civil Rights, research monitors and IRB reviewers, and accreditation agencies.
Optional Storage of Data
PHI That Will Be Used/Disclosed In The Future:
The PHI that we will use and/or disclose (share) for the optional storage and future research of your PHI includes your medication adherence, response to all text messages, and survey responses. These will be de-identified for all future use.
Purposes For Which Your PHI Will Be Used/Disclosed:
We will use and disclose your PHI for the conduct and oversight of future research regarding efficacy of the Spruce Health platform as well as further iteration of this platform.
People Who Will Use/Disclose Your PHI:
The same people and groups who will use and disclose your PHI, as mentioned above, will also have the ability to use your de-identified data in future research-based instances.
Expiration Of Your Authorization:
Your PHI will be used until your enrollment on the Spruce Health platform ends. If any data is used post-enrollment, it will be de-identified prior to use.
Revoking Your Authorization:
If you sign this form, at any time later you may revoke (take back) permission to allow the Spruce Health team to use your information. If you want to do this, you must contact the Spruce Health team in any of the following ways:
Email: legal@sprucehealth.com
Email: support@sprucehealth.com
At that point, no more of your PHI would be collected or transmitted via text message. Spruce Health may use or disclose the information you already gave them so they can follow the law, protect your safety, or make sure that the collected data is correct. If you revoke your authorization, you will not be able to stay on the platform.
Other Items You Should Know About Your Privacy:
Not all people and entities are covered by the Privacy Rules. HIPAA only applies to health care providers, health care payers, and health care clearinghouses. If we disclose your information to people who are not covered by the Privacy Rules, including HIPAA, then the Privacy Rules won’t protect your information. People who do not have to follow the Privacy rules can use or disclose your information with others without your permission if they are allowed to do so by the laws that cover them.
At any time, you may request access to your PHI either via text message or directly from the Spruce Health team. A designated record set containing your PHI will be provided to you, if requested. A designated record set is data that includes all data you have provided over the course of your enrollment on the Spruce Health platform.
We may remove identifying information from your PHI. Once we do this, the remaining information will not be subject to the Privacy Rules. Information without identifiers may be used or disclosed with other people or organizations for purposes outside of your care.
Contact Information
If you have any questions about usage of the Spruce Health platform or questions about management of your PHI or protection of your privacy, please email Spruce at support@sprucehealth.com.
If you consent to the above information and Spruce Health transmitting PHI and any other health information over SMS, email, or phone, to and from the Spruce Health platform, please respond ‘Y’ or ‘Yes’ to the last message you received from this phone number.